Privacy policy

Your account. Your email address, a display name, your password (stored only as a one-way hash, never as the password itself), your time zone (so “today” is your day), and optional details you can add for macro targets such as sex and age.

What you log. Everything you enter is stored against your account so it can be shown back to you: workouts (templates, exercises, sets, reps, weights, the warm-up and cooldown movements you tick off), meals and macros, pantry items and meal prep, water, body measurements, goals and milestones, habits and routine check-offs, daily notes, your Daily Reader topics, and any peptides or supplements you choose to record.

Progress photos. Only if you upload them. Each photo has its metadata stripped before it is stored (camera details, orientation and GPS location are removed), is kept in private object storage that has no public access, and is only ever served back to the account that uploaded it. No one else can open a link to your photo.

Billing. If you subscribe, your card is entered on Stripe’s checkout page, not ours. We store Stripe’s customer and subscription identifiers and the subscription status (trialing, active, cancelled, and its period end) so the app knows whether you are a member. Card numbers never reach our servers.

Feedback. Anything you send through the Feedback page, with its category and status, tied to your account.

Technical records. A first-party page-view log (which page, which day, and your account id if you were logged in — never the full URL, never a third-party script on member pages); short-lived counters keyed by IP address that rate-limit login, signup and password-reset attempts; a per-day count of your AI requests; and ordinary server logs used to find faults.

Some features send what you type or photograph to Anthropic’s Claude API to produce a result: estimating macros from a meal description or a meal photo, reading a pantry label, meal and recipe suggestions, workout suggestions, tidying up a dictated note, and generating your short daily read from the topics you chose. The request contains the text or image you submitted and the context needed for the answer (for example your remaining macro targets for the day). It does not contain your name, email address or account id.

Anthropic processes that request under its own terms and privacy policy. If you would rather nothing you log leaves FitRetro, enter macros and notes by hand — every AI feature is optional and the app works without it.

• Stripe — payments and subscription management. Stripe receives your email and card details at checkout.
• Anthropic — the AI features described above.
• Resend — sends password-reset emails to your address.
• DigitalOcean — hosts the application, its database and the private photo storage.
• Google Analytics — on the public pages only (the landing page, signup, login, help, password reset, and the sticker link). It is never loaded on the pages you use once logged in, so it sees nothing you log. It sets its own cookies on those public pages; you can block them in your browser without affecting the app.

We do not sell your data, share it with advertisers, or use it for anything other than running FitRetro for you.

• session — keeps you logged in for 7 days. Required.
• fr_campaign — set for 30 days when you arrive through the printed sticker’s link, so the sticker offer is applied at checkout.
• Google Analytics cookies — public pages only, as above.

For as long as your account exists. You can edit or delete individual entries and photos at any time from the app, and those deletions are immediate. When you delete your account (section 6) your rows and photos are removed at once; Stripe keeps the payment records it is required to keep, we keep a dated note that an account was deleted (with no name, email or id on it), and short-lived technical records (rate-limit counters, server logs) expire on their own.

• See and change your data — everything you logged is visible and editable in the app.
• Delete photos or entries — from the app, immediately.
• Cancel your subscription — any time from Settings › Billing; membership continues to the end of the period you paid for.
• Sign out everywhere — Settings › Security ends every session.
• Delete your account — Settings › Account, with your password. It is immediate and permanent: any subscription is cancelled, your photos are removed from storage, and every row belonging to the account is deleted. Stripe keeps the payment records it is required to keep.
• Get a copy of your data — there is no self-serve export yet. To request one, use the Feedback page while logged in; it is sent within 30 days.

Passwords are hashed, traffic is encrypted (HTTPS), sessions are signed and expire, and photos are only reachable through the app with your login. No system is perfectly secure; if we learn of a breach affecting your data we will tell you at the email on your account.

FitRetro is for adults. Do not create an account if you are under 18, and do not enter information about someone else.

When this page changes, the date at the top changes with it. Questions about your data: use the Feedback page while logged in. Membership is $8/month; the terms that apply to it are in the terms of use.